Daniel Lezcano <[EMAIL PROTECTED]> writes:
> Andreas B Aaen wrote:
>> Ok. Here is my use case.
>> I need a to talk to 500 IPv4 networks with possible overlapping IP
>> addresses. The packages arrive on 500 VLANs. I want one process to listen to
>> a
>> port on each of these networks. I don't want 500 processes that runs in each
>> their network namespace and then communicate with each other through e.g.
>> unix
>> sockets. This just complicates the task.
>
> Why don't you unshare 500 times in the same process ? In each namespace you
> create a socket control and the fd number is the identifier of your namespace.
That is the other good option I have thought of for doing this.
It is certainly a bit easier to implement.
There are problems with application restart. So I am concerned with
how well use sockets as identifiers will scale. But I don't have
any problems in principle.
There is a similar use case where simply have several disjoint domains
that you are performing software routing between and except for
configuration the kernel doesn't need any special support.
I do think just using unshare for the creation and not implementing
a newinstance filesystem option for now makes sense. That way we can
support mounting of /proc/net and sysfs in those network namespaces
without having to teach them how to parse options as well.
Making the application creation loop something like:
for name in $(seq 1 500) ; do
unshare(CLONE_NEWNS);
mkdir /dev/vrf/$name/proc
mkdir /dev/vrf/$name/sys
mkdir /dev/vrf/$name/handle
mount -t netns none /dev/vrf/$name/handle
mount -t proc/net none /dev/vrf/$name/proc
mount -t sysfs none /dev/vrf/$name/sys
done
Eric
_______________________________________________
Containers mailing list
[EMAIL PROTECTED]
https://lists.linux-foundation.org/mailman/listinfo/containers
_______________________________________________
Devel mailing list
[email protected]
https://openvz.org/mailman/listinfo/devel
